Virtual Network Security and Logging GPCS Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company is deploying a three-tier web application in a single VNet. The web tier must accept HTTPS traffic from the internet, the application tier must only accept traffic from the web tier, and the database tier must only accept traffic from the application tier. All tiers are in separate subnets. Which configuration should be implemented to meet these requirements?

   • ACreate a separate VNet for each tier and peer them together without any filtering.
   • BPlace all tiers in the same subnet and rely on host-based firewalls on each VM to restrict traffic.
   • CUse a single NSG applied to the entire VNet with rules that allow all traffic within the VNet.
   • DApply a network security group (NSG) to each subnet with rules that allow only the required source and destination ports and protocols.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security analyst is reviewing NSG flow logs and notices that a VM is sending a large amount of data to an IP address in a foreign country. The VM is a web server that should only communicate with internal resources. The analyst suspects data exfiltration. What should the analyst do first?

   • AImmediately block the IP address in the NSG.
   • BDisable the VM's network interface to stop the traffic.
   • CCheck the NSG rules to see if outbound traffic to that IP is allowed.
   • DReview the VM's logs to see what process is generating the traffic.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company must retain network traffic logs for at least one year to meet a regulatory requirement. They have enabled NSG flow logs and are sending them to a Log Analytics workspace. The security team wants to query the logs for specific source IPs and also needs to ensure the logs are not deleted before the retention period. What should they configure?

   • ASet the Log Analytics workspace retention to 365 days and use the workspace for querying the flow logs.
   • BExport the flow logs to an Azure Storage account with a lifecycle management policy that deletes blobs after 365 days.
   • CUse Azure Monitor alerts to archive the logs to a cold storage tier after 30 days.
   • DEnable flow logs and set the retention period in the flow log configuration to 365 days.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company has a hub-and-spoke VNet topology. The hub contains a shared firewall appliance. The spokes contain application workloads. The security team wants to enforce that all outbound internet traffic from the spoke VMs goes through the hub firewall. They have configured user-defined routes (UDRs) in the spoke subnets to send internet-bound traffic to the firewall's IP. However, they notice that some traffic is bypassing the firewall. What is the most likely reason?

   • AThe VMs have multiple NICs and are using a different NIC that is not covered by the UDR.
   • BThe spoke subnets have NSGs that allow direct internet access, overriding the UDR.
   • CThe firewall appliance is not configured to accept the traffic from the spoke subnets.
   • DThe UDR is not applied to the subnet where the VMs are located, or the route table is not associated with the subnet.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company is designing a VNet for a three-tier application. The web tier must be accessible from the internet, the app tier should only be accessible from the web tier, and the database tier should only be accessible from the app tier. The security team wants to ensure that each tier is isolated and that all traffic is logged. What is the best approach?

   • AUse Azure Firewall to filter traffic between the tiers and enable firewall logs.
   • BCreate three subnets, one for each tier, and apply NSGs to each subnet with rules that allow only the required traffic. Enable NSG flow logs on all NSGs.
   • CCreate one subnet for all tiers and use NSGs on each VM's NIC to control traffic.
   • DCreate three separate VNets and use VNet peering to connect them.
   Reveal Solution Discussion Select an answer first